ci: add Wazuh logtest validation contract

[raylee-hawkins]

Summary

• Adds Wazuh logtest/static validation registry.
• Adds controlled sample events for HO-DET-011 and HO-DET-012 Wazuh contract validation.
• Adds static CI validation that does not require live Wazuh manager access by default.
• Supports optional private wazuh-logtest execution later when a gated private runner provides it.

Boundaries

• Does not prove live Wazuh routing.
• Does not prove runtime signal.
• Does not update public proof.
• No live Wazuh manager config/rules/decoders were changed.
• No deployment occurred.

Validation Evidence

• python -B scripts\verify_validation_registry.py
• python -B scripts\verify_all_validation_packages.py
• python -B scripts\verify_validation_contract.py
• python -B scripts\verify_wazuh_logtest_registry.py
• python -B -m unittest discover -s tests
• python -B scripts\verify_wazuh_logtest_registry.py --detections-root <detections worktree>
• Result: passed
• WAZUH_LOGTEST_REGISTRY=pass mode=static entries=3
• Ran 49 tests ... OK

Proof Ceiling

SOURCE_AND_STATIC_CI_CONTRACT_ONLY

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7d49be65fb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[raylee-hawkins]

Human governance review for validation PR #64:

Reviewed the Wazuh logtest/static validation contract change.

This PR correctly adds a Wazuh validation registry, controlled sample event contracts for HO-DET-011 and HO-DET-012, and CI validation that does not require live Wazuh manager access by default.

Important boundary confirmed:

Static CI contract is enforced.
Optional private wazuh-logtest execution is future-gated.
No live Wazuh routing is proven.
No runtime signal is claimed.
No public proof update is made.
The validation repo remains validation authority, not deployment authority.

Checks are passing. This is merge-eligible after final merge gate, with proof ceiling remaining SOURCE_AND_STATIC_CI_CONTRACT_ONLY.